#!/bin/bash
set -o errexit

# ssl cert path
# ssl files must be uploaded to headnode sslkey_path directory
sslkey_path=/var/tmp/sslkey

install_adminui=true
install_cloudapi=true
install_docker=true


# ssl_cert file(2 files, xxx.pem & xxx-key.pem)
adminui_sslfile=cloudportal.dev.wiz.top
cloudapi_sslfile=cloudapi.dev.wiz.top
clouddocker_sslfile=clouddocker.dev.wiz.top




PEM=${sslkey_path}/temp.pem

if [ ${install_adminui} == true ];then
    ADMINUI=$(vmadm list |grep adminui0| awk '{ print $1}')

    cat ${sslkey_path}/${adminui_sslfile}{.pem,-key.pem} > ${PEM}

    echo "backup adminui default.pem"
    cp /zones/${ADMINUI}/root/opt/smartdc/adminui/etc/ssl/default.pem ${sslkey_path}
    echo "replace adminui pem"
    cp ${PEM} /zones/${ADMINUI}/root/opt/smartdc/adminui/etc/ssl/default.pem
    echo "restart adminui services"
    sdc-login adminui 'svcadm restart adminui'
    echo "check adminui cert"
    sdc-login adminui 'echo QUIT | openssl s_client -host 127.0.0.1 -port 443 -showcerts'
    echo "adminui ssl cert setup finished"
fi

if [ ${install_cloudapi} == true ];then

    CLOUDAPI=$(vmadm list |grep cloudapi0| awk '{ print $1}')

    # 20201204T025059Z not 20201204T025050Z, for > compare
    base_version=20201204T025050Z
    default_version=$(sdcadm platform list -j|json -c 'this.default==true' 0.version)

    cat ${sslkey_path}/${cloudapi_sslfile}{.pem,-key.pem} > ${PEM}
    cloud_cert_path=opt/smartdc/cloudapi/ssl/stud.pem
    cloud_svc_name=stud
    if [ ${default_version} \> ${base_version} ]; then
        cloud_cert_path=data/tls/cert.pem
        cloud_svc_name=haproxy
    fi   
    echo "backup cloudapi pem"
    cp /zones/${CLOUDAPI}/root/${cloud_cert_path} ${sslkey_path}
    echo "replace cloudapi pem"
    cp ${PEM} "/zones/${CLOUDAPI}/root/${cloud_cert_path}"
    echo "restart cloudapi services"
    sdc-login cloudapi 'svcadm restart cloudapi:cloudapi-8081'
    sdc-login cloudapi 'svcadm restart cloudapi:cloudapi-8082'
    sdc-login cloudapi 'svcadm restart cloudapi:cloudapi-8083'
    sdc-login cloudapi 'svcadm restart cloudapi:cloudapi-8084'    
    sdc-login cloudapi "svcadm restart ${cloud_svc_name}"
    echo "check cloudapi cert"
    sdc-login cloudapi 'echo QUIT | openssl s_client -host 127.0.0.1 -port 443 -showcerts'
    echo "adminui ssl cert setup finished"
fi


if [ ${install_docker} == true ];then
    echo "install docker ssl cert"
    sdcadm experimental install-docker-cert -k ${sslkey_path}/${clouddocker_sslfile}-key.pem -c ${sslkey_path}/${clouddocker_sslfile}.pem
    echo "replace docker_endpoint"
    docker_endpoint="tcp://${clouddocker_sslfile}:2376"
    cloudapi_svc=$(sdc-sapi /services?name=cloudapi | json -H 0.uuid)
    sapiadm get $cloudapi_svc \
        | json -e "
            svcs = JSON.parse(this.metadata.CLOUDAPI_SERVICES || '{}');
            svcs.docker = '$docker_endpoint';
            this.update = {metadata: {CLOUDAPI_SERVICES: JSON.stringify(svcs)}};
            " update \
        | sapiadm update $cloudapi_svc

    echo "check docker endpoint"
    sapiadm get $(sdc-sapi /services?name=cloudapi | json -H 0.uuid) | json -Hag metadata.CLOUDAPI_SERVICES
    echo "docker ssl cert setup finished"
fi
